# Microsoft Entra ID Configuration for the WorkflowGen CLI

{% hint style="warning" %}
Azure Active Directory (Azure AD) has been renamed to **Microsoft Entra ID** (**ME-ID**). While the WorkflowGen documentation has been updated to reflect this name change, the WorkflowGen application settings still refer to Azure AD (for example, `Azure AD SCIM v2` directory connector). 

Likewise, certain ME-ID configuration items in the Azure portal have been renamed and/or moved. The WorkflowGen documentation has been updated accordingly, but still might not be completely accurate in this regard. See the [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/) documentation for more information.
{% endhint %}

## Prerequisites

* Make sure to have a licensed copy of WorkflowGen installed and running on an IIS web server in **HTTPS** secure connection mode.
* Make sure to have **Microsoft Entra ID (ME-ID) administrator access** to be able to configure it.
* Make sure to have provisioned an existing ME-ID user with which you can authenticate to WorkflowGen so that you can use the application afterwards.
* Make sure to have successfully configured delegated authentication to ME-ID with the **Microsoft Identity Platform v2.0** provider on your WorkflowGen instance following the instructions in the [Microsoft Entra ID Authentication](https://docs.workflowgen.com/azure/8.0/azure-active-directory-authentication) section with the `WorkflowGen GraphQL API` application registered as well.

## Interactive mode

### Microsoft Entra ID configuration

This configuration is done in three steps. First, you have to register a new native application in ME-ID. Then, you have to give the application the necessary permissions to access the WorkflowGen GraphQL API. Finally, you have to register the correct callback URLs that will redirect within the native application.

#### Step 1: Register a new native application

1. In the Azure portal, click **App registrations** in the **Azure services** section.

2. Click **New registration**, and fill in the properties:

   * **Name:** `WorkflowGen CLI` 
   * **Supported account types:** `Accounts in this organizational directory only (Default Directory only - Single tenant)`\
     ✏️ **Note:** Depending on the context, you should choose the right option for your use case for the supported account type value.
   * **Redirect URI:** 
     * **Platform:** `Public client/native (mobile & desktop)` 
     * **Value:** `http://127.0.0.1:8888/callback`

   ✏️ **Note:** Port `8888` is defined by default; you can change it if it's already in use on your computer.

    

3. Click **Register** at the bottom of the page.

You've now successfully registered your `WorkflowGen CLI` native application in ME-ID.

#### Step 2: Grant access to the GraphQL API

1. Click **API permissions**.<br>
2. In the **Configured permissions** section, click **Add a permission**.<br>
3. Click **My APIs**, then select the `WorkflowGen GraphQL API` application in the list.<br>
4. Click **Delegated permissions** and check `default` under the **Permission** column.<br>
5. Click **Add permissions**.<br>
6. On the **API permissions** page, click **Grant admin consent for \<your tenant name>**, then click **Yes**.

#### Review the registration

Take note of the information you'll need later on:

* A **client ID:** This is the application (client) ID in the **Overview** section of your application registration.
* A **tenant ID:** This is the directory (tenant) ID in the **Overview** section of your application registration.

You'll need to give this information to the users who will be using the WorkflowGen CLI.

{% hint style="success" %}
You've now successfully registered the WorkflowGen CLI in Microsoft Entra ID.
{% endhint %}

## Non-interactive mode

The configuration of non-interactive mode is the same as in the [Microsoft Entra ID Configuration for Server-Side Scripts](https://docs.workflowgen.com/azure/8.0/azure-active-directory-configuration-for-server-side-scripts) section.